Do passwords still need to be changed every 90 days?

Whether you keep changing passwords on a schedule depends on who knows the password. NIST SP 800-63B-4 bans scheduled changes, and the guideline assumes only the user knows the password. PCI DSS drops them where a second factor is used. A shared account used by several people breaks NIST’s assumption.

What NIST SP 800-63B-4 says

NIST SP 800-63B-4 is NIST’s guideline for how services check who is signing in. NIST published the final version in July 2025. Password rules are in section 3.1.1.2. They’re addressed to verifiers, the services that check the password, and CSPs, the organizations that issue and manage the accounts.

Keep the audience in mind when you cite this section. It tells services not to force scheduled changes on their users. If your company drops scheduled changes from its employee policy because of it, you’re applying NIST’s reasoning to your own staff, which the section itself doesn’t address.

The guideline’s introduction says users are responsible for protecting their sign-in secrets and “not disclosing them to others.” Read together, the rule against scheduled changes appears to assume that only the user knows the password.

The earlier version, published in 2017, said services “SHOULD NOT” require changes for no reason, such as on a schedule. Revision 4 made that a “SHALL NOT.”

What PCI DSS says

PCI DSS is the data security standard for payment card data, set by the PCI Security Standards Council (PCI SSC). Version 4.0.1, published in June 2024, replaced version 4.0, which PCI SSC retired on December 31, 2024. PCI SSC says 4.0.1 added and removed no requirements.

Requirement 8.3.9 covers passwords that are the only factor for user access, meaning any setup with no second factor. In that case, one of two things must be true. Either passwords change no less often than every 90 days, or the system analyzes each account’s security in real time and decides access from that. PCI SSC’s FAQ 1590 says 8.3.9 doesn’t apply to systems where multi-factor authentication is used.

PCI DSS also wants a change when something goes wrong. Requirement 8.3.8 asks for written password policies that tell users to change a password if they suspect or know it’s been compromised, and how to report it.

Why scheduled changes can go

A scheduled change limits how long a stolen password keeps working when nobody notices the theft. Change every 90 days, and an unnoticed leak stops working within 90 days at most. That only helps if you have no better way to notice.

Both sources expect a change when there’s evidence of a compromise. Signs of a compromise include a breach notice from the service, a sign-in alert, a match on a breach-check site, or an odd entry in the account’s sign-in history. Once you change the password at that point, it stops working sooner than if you’d waited for the next deadline. Until then, the defense is a long, unique password checked against a blocklist, plus a second factor.

Why shared accounts don’t fit

Dropping scheduled changes rests on two conditions. Only the owner knows the password, and anyone else’s use leaves evidence. A shared account meets neither.

First, several people know the password from day one. NIST assumes people don’t tell others their password, and a shared account works only because they do. Second, the group changes. When someone leaves or moves to another team, they still remember the password. For a personal account, that would count as a stranger knowing it. For a shared account, there’s no evidence of it. The service’s records show only the account name, so a former user’s sign-in looks like anyone else’s.

So on a shared account you can’t switch from “change on a schedule” to “change on evidence.” The change has to happen when the group that knows the password changes: a departure, a role change, the end of a contractor’s work. NIST SP 800-53 Rev. 5, the control catalog federal systems must use, covers this in control AC-2 k. It asks for a process to change a shared or group account’s password when someone is removed from the group.

The new password then goes to everyone who stays, so the next departure means doing it all again. Dropping scheduled changes doesn’t remove this work.

When you can drop scheduled changes

Until a shared account meets the conditions in the first and last rows, you have no basis for dropping its scheduled changes. Managing shared accounts compares the ways to meet those conditions. What is two-step verification? covers sharing a second factor.